Despite improving preparedness, US small businesses remain highly vulnerable to cyber incidents. A new report reveals that although these businesses spent less to respond to cyber incidents last year, this was counteracted by an increase in attacks and breaches.

The median number of attacks has risen from 3 in 2022 to 4 in 2023, and 41% of small businesses fell victim to a cyber attack in 2023, compared to 38% in 2022 and 22% in 2021. Over the past 12 months, US small businesses paid over $16,000 in cyber ransoms.

Chris Hojnowski, vice president and product head of technology and cyber at Hiscox USA, expressed concern over the rise in cyber attacks, stating that 41% is not far off from a coin flip of it happening to a business. Hiscox polled over 500 US small business professionals and assessed their preparedness to combat cyber incidents as part of a global survey involving over 5,000 professionals responsible for their company’s cyber security strategy.

Hojnowski also pointed out that although the cost of cyber breaches has decreased somewhat, the number of attacks has grown, offsetting the decrease in cost. He mentioned that new artificial intelligence developments have made it more challenging to identify phishing emails.

He emphasized the importance of constant vigilance and the use of AI tools to protect small business owners. The report also highlighted the need for additional investments in cyber security, training, and insurance, particularly in view of the growing complexity of cyber-attacks.

Despite an increase in IT security spending, Hiscox’s report showed that many small businesses still do not use security awareness training or have network-based firewalls. Hojnowski stressed the importance of better training for employees as a key defense against various types of losses.

The report revealed that the US ranks second for cyber maturity and that only 4% of small businesses are cyber experts. It called for thoughts on Hiscox’s cyber readiness report for small businesses in the US.